Wukongopensource vulnerabilities

11 vulnerabilities

Known vulnerabilities in Wukongopensource products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.

Products

4
RoutineCVE-2026-110208wukongopensource · wukong aicrmWukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider KeysWukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.CVSS7.1HighEPSS0.39%RoutineCVE-2026-110207wukongopensource · wukong aicrmWukong AICRM through 20260610 Missing Authorization in User and Role Management APIsWukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.CVSS8.8HighEPSS0.45%PrioritiseCVE-2026-108708wukongopensource · wukong_hrmWukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtilWukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.CVSS8.8HighEPSS0.28%PrioritiseCVE-2026-108707wukongopensource · wukong_hrmWukong_HRM through commit 186115e Authentication Bypass via ParamAspectWukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.CVSS9.8CriticalEPSS0.55%RoutineCVE-2026-108689wukongopensource · wukong aicrmWukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/sendWukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.CVSS5.4MediumEPSS0.17%RoutineCVE-2026-2141wukongopensource · wukongcrm +1 moreWuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorizationA security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java of the component URL Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.CVSS8.8HighEPSS0.40%RoutineCVE-2025-8852wukongopensource · wukongcrm +1 moreWuKongOpenSource WukongCRM API Response upload information exposureA vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.CVSS5.3MediumEPSS0.40%RoutineCVE-2025-6106wukongopensource · wukongcrm +1 moreWuKongOpenSource WukongCRM AdminRoleController.java cross-site request forgeryA vulnerability was found in WuKongOpenSource WukongCRM 9.0 and classified as problematic. This issue affects some unknown processing of the file AdminRoleController.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS5.3MediumEPSS0.28%RoutineCVE-2025-5879wukongopensource · wukongcrm +1 moreWuKongOpenSource WukongCRM File Upload AdminSysConfigController.java cross site scriptingA vulnerability, which was classified as problematic, was found in WuKongOpenSource WukongCRM 9.0. This affects an unknown part of the file AdminSysConfigController.java of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS5.4MediumEPSS0.31%RoutineCVE-2025-5521wukongopensource · wukongcrm +1 moreWuKongOpenSource WukongCRM updataPassword cross-site request forgeryA vulnerability was found in WuKongOpenSource WukongCRM 9.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/user/updataPassword. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS8.8HighEPSS0.33%RoutineCVE-2024-6645wukongopensource · wukong_nocodeWuKongOpenSource Wukong_nocode AviatorScript ExpressionUtil.java deserializationA vulnerability was found in WuKongOpenSource Wukong_nocode up to 20230807. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file ExpressionUtil.java of the component AviatorScript Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-271051.CVSS6.5MediumEPSS0.54%